Attack Chain

1. Attacker creates an application and adds a Table Widget.
2. Attacker injects a malicious XSS payload into the Table Data property.
3. Attacker uses the "Share" feature to invite an administrative user to the application.
4. The administrator clicks the invitation and views the malicious table.
5. The XSS payload executes in the administrator's browser session.
6. The payload extracts the administrator's XSRF-TOKEN from document.cookie.
7. The payload sends a malicious PUT request to administrative API endpoints (e.g., /api/v1/admin/env) to add the attacker's account to the administrative whitelist.
8. The attacker authenticates as the upgraded account, gaining full administrative control over the instance.

Impact

Successful exploitation results in full administrative takeover of the Appsmith instance. This allows attackers to access sensitive environment variables, database credentials, and modify any application within the instance.

Recommendation

1. Upgrade all Appsmith instances to version 1.96 or later immediately.
2. Implement a strict Content Security Policy (CSP) that includes a restricted connect-src directive to prevent unauthorized API calls from browser-side scripts.
3. Audit existing application Table Widgets for anomalous scripts or payload-like structures in data properties.